Privacy Policy

1. Personal Data Mrafqk Collects

Mrafqk collects the following categories of personal data:

• Account & identity data: your name, phone number, email address, and password.
• Patient data: information you provide about the patient you are booking for, including name, age, hospital, appointment details, and any special needs you choose to share.
• Booking data: the services you request, dates, locations, hospitals, your chosen transport option, pick-up and drop-off addresses, and your booking history.
• Companion professional data (Companions only): nursing licence or registration numbers, credential documents and their expiry dates, the issuing authority, and the result of Mrafqk's verification checks.
• Companion vehicle data (only for Companions who take transport bookings): driving licence, vehicle registration (Istimara), motor insurance, and the vehicle's make, model, and plate.
• Payment data: if you choose to save a card, the cardholder name, the last four digits, the card network, and the expiry date. The full card number never leaves your device and is never sent to Mrafqk's servers. For Companions, the bank account details (IBAN) needed to pay you.
• Location data: the coordinates of the pick-up point for a booking, saved only when you tap "Use my current location" while the app is open. Providing them is optional; you can type an address instead.
• Communications: in-app chat messages, support requests, and reviews, which are logged for safety, quality, and transparency.
• Device data: your device's push notification token, so Mrafqk can send you booking notifications.

Some health-related details (such as the type of treatment) may be shared by you to arrange a suitable companion. Mrafqk treats such information as sensitive data and applies additional safeguards. Companions are licensed nurses engaged in a non-clinical companion role and do not provide medical care through the Platform.

2. How Mrafqk Uses Your Data

Mrafqk uses personal data for the following purposes:

• To create and manage your account;
• To process booking requests and price offers, and to match you with a suitable Companion;
• To verify Companion nursing credentials, and where relevant driving licence and vehicle documents, before approving an account and periodically thereafter;
• To arrange the transport option you select, including booking a ride with a third-party ride-hailing provider on your behalf;
• To show booking status updates, enable in-app communication, and deliver visit reports;
• To provide customer support and respond to your enquiries;
• To ensure safety, prevent fraud, and enforce the Mrafqk Terms of Service;
• To improve the Platform and develop new features;
• To send service-related notifications and, where permitted, marketing communications you may opt out of;
• To comply with legal, regulatory, and contractual obligations in the Kingdom of Saudi Arabia.

3. Legal Basis for Processing

Mrafqk processes personal data where: you have given consent; processing is necessary to perform a contract with you; processing is required to comply with a legal obligation; or processing serves a legitimate interest that does not override your rights, as permitted under the PDPL. You may withdraw consent at any time, without affecting processing carried out before withdrawal.

4. Sharing and Disclosure

Mrafqk does not sell your personal data. Mrafqk may share it with:

• Companions, to the extent necessary to deliver the service you booked (e.g., patient name, location, appointment details);
• Third-party ride-hailing providers, where you select that transport option, so the ride can be booked and completed;
• Service providers acting on Mrafqk's behalf (e.g., cloud hosting, email delivery, push notifications) under appropriate confidentiality and data protection obligations;
• Partner hospitals, to confirm a Companion's affiliation and where necessary for access and coordination, subject to their own policies;
• Competent authorities, where required by applicable Saudi law or to protect rights, safety, and security.

If you pick a ride-hailing option, Mrafqk passes on only what the journey needs: pick-up and drop-off locations, the timing, and a name and phone number for the passenger. Diagnosis, treatment type, and any other health detail stay with Mrafqk. Once the ride is booked, the provider handles that data as an independent controller under its own privacy policy.

5. Payments

Payment for a booking is settled on completion of the visit, at the price you and your Companion agreed before the booking was confirmed.

Card payment in the app is processed by the Moyasar payment gateway. Your card details are sent directly to Moyasar, which handles them under its own privacy policy and the applicable card security standards. Mrafqk does not receive or store your full card number.

If you save a card in the app for convenience, only the cardholder name, the last four digits, the card network, and the expiry date are held on Mrafqk's systems. Saving a card does not authorise a charge on its own: a charge is only made once a visit has been completed.

6. Location

When you set the pick-up point for a booking, you can tap "Use my current location" and Mrafqk saves those coordinates with that booking so your Companion can navigate to you. This is optional: you can type an address instead. Mrafqk collects location only at that moment, only while the app is open, and only when you tap the button.

Mrafqk does not track your location in the background, and does not track any journey in real time. Where a third-party ride-hailing provider supplies the ride, that provider processes location data for the journey under its own privacy policy. You can disable location permissions in your device settings and still book normally by typing the address.

7. Data Retention

Mrafqk retains personal data only for as long as necessary to fulfil the purposes described in this Policy, including to meet legal, accounting, tax, and regulatory requirements in the Kingdom of Saudi Arabia. When data is no longer needed, Mrafqk securely deletes or anonymizes it.

8. Deleting Your Account

You can close your account at any time from Profile → Delete account in the app, which disables it immediately so it can no longer be signed into. To have the personal data attached to it erased as well, email privacy@mrafqk.com from the address on your account; Mrafqk verifies ownership and completes the erasure within 30 days.

Full details of what is deleted and the small set of records Mrafqk must keep under Saudi law: https://mrafqk.com/en/delete-account

9. Data Security

Mrafqk applies appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure, including encryption in transit, access controls, and ongoing monitoring. No method of transmission or storage is completely secure, and Mrafqk cannot guarantee absolute security.

10. Your Rights under the PDPL

Subject to the PDPL and its Implementing Regulations, you have the right to:

• Be informed about how your personal data is collected and used;
• Access your personal data held by Mrafqk;
• Request correction of inaccurate or incomplete data;
• Request deletion of your data where there is no lawful basis to retain it;
• Withdraw consent to processing based on consent;
• Object to or restrict certain processing in accordance with the law.

To exercise any of these rights, contact Mrafqk using the details below. Mrafqk may need to verify your identity before responding.

11. Cross-Border Transfers

Where personal data is transferred outside the Kingdom of Saudi Arabia (for example, to a cloud service provider), Mrafqk does so only in accordance with the PDPL and its Implementing Regulations and apply appropriate safeguards to protect your data.

12. Children's Privacy

The Platform is intended for users aged 18 and over. Mrafqk does not knowingly collect personal data directly from children. Where a booking concerns a minor patient, the information is provided by a responsible adult acting on the patient's behalf.

13. Changes to this Policy

Mrafqk may update this Privacy Policy from time to time. Material changes will be communicated through the Platform. The "Last updated" date above indicates when the Policy was last revised.

14. Contact and Complaints

For privacy enquiries or to exercise your rights, contact the Mrafqk data protection point of contact at privacy@mrafqk.com. You also have the right to lodge a complaint with the competent supervisory authority in the Kingdom of Saudi Arabia.

Email: privacy@mrafqk.com | Website: mrafqk.com | Address: Riyadh, Kingdom of Saudi Arabia